linux-kernel - Re: Wake-up from suspend to RAM broken under `retbleed=stuff`

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <cfe514f9-bf6c-292d-a481-48614aeb9dd6@citrix.com>
Date:   Wed, 11 Jan 2023 22:06:56 +0000
From:   Andrew Cooper <Andrew.Cooper3@...rix.com>
To:     Jan Beulich <jbeulich@...e.com>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Juergen Gross <jgross@...e.com>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        xen-devel <xen-devel@...ts.xenproject.org>,
        Roger Pau Monne <roger.pau@...rix.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Joan Bruguera <joanbrugueram@...il.com>
Subject: Re: Wake-up from suspend to RAM broken under `retbleed=stuff`

On 11/01/2023 11:45 am, Jan Beulich wrote:
> On 11.01.2023 12:39, Andrew Cooper wrote:
>> The bigger issue with stuff accounting is that nothing AFAICT accounts
>> for the fact that any hypercall potentially empties the RSB in otherwise
>> synchronous program flow.
> But that's not just at hypercall boundaries, but effectively anywhere
> (i.e. whenever the hypervisor decides to de-schedule the vCPU)?

Correct, but it's only the RET instructions that reliably underflow the
RSB which can be usefully attacked.

The %rip at which Xen decides to de-schedule a vCPU are random from the
point of view of an attacker.

~Andrew